[HADOOP-18388] Allow dynamic groupSearchFilter in LdapGroupsMapping

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Component/s: security
• Labels: Reviewed pull-request-available
• Target Version/s: 3.4.0
• Hadoop Flags: Reviewed
• Assignee: Ayush Saxena
• Reporter: Ayush Saxena
• Created: 03/Aug/22 12:31
• Updated: 28/Jan/24 00:15
• Resolved: 07/Sep/22 12:54

Description

As of now the lookupGroup() method doesn't allow to have placeholders in 

groupSearchFilter, so that can not be dynamically adjusted.

If we have placeholders for groupSearchFilter like: (&(|(XYZ={0})(ABC={1}))(objectClass=posixGroup))

This fails here:

 

groupResults =
    c.search(groupbaseDN,
        "(&" + groupSearchFilter + "(" + groupMemberAttr + "={0}))",
        new Object[]{userDn},
        SEARCH_CONTROLS); 

With 

 

 

javax.naming.directory.InvalidSearchFilterException: number exceeds argument list: 1; remaining name 

 

>>Dropped off or changed the details above which I thought won't be safe to disclose.

 

Issue Links

• links to: GitHub Pull Request #4798